CVE-2022-2839

What it actually does

Missing authorization and CSRF protections on all AJAX endpoints combined with absent input sanitization allow unauthenticated callers to invoke plugin functions and store arbitrary script payloads that execute in admin sessions.

Why it matters to the business

Attackers can hijack administrator sessions in any WordPress site using the vulnerable plugin, enabling theft of sensitive project data, account takeover, or further site compromise; the plugin's widespread use in project-management workflows increases exposure across many organizations.

How an attack unfolds

An unauthenticated attacker discovers the plugin's AJAX endpoints, crafts requests that bypass nonce and permission checks, injects malicious JavaScript via unsanitized parameters, and waits for an administrator to view the affected page so the payload executes in the admin context.

How to fix it

Upgrade the Zephyr Project Manager plugin to version 3.2.55 or later; if an immediate update is not possible, restrict public access to wp-admin/admin-ajax.php and review plugin code for nonce and capability checks.

How to confirm the fix worked

Confirm the installed plugin version is at least 3.2.55 via the WordPress plugins page or wp-content/plugins/zephyr-project-manager/readme.txt; re-test AJAX endpoints to verify nonce and authorization requirements are enforced.

Typical attack path

1. Identify exposed WordPress site running Zephyr Project Manager < 3.2.55
2. Locate unauthenticated AJAX action handlers via source inspection or enumeration
3. Send crafted POST/GET requests containing malicious script payloads without valid nonces
4. Trigger stored XSS when an administrator loads an affected dashboard or project view
5. Escalate to session hijacking, data exfiltration, or plugin privilege escalation

How to detect it

Search web server and WordPress access logs for repeated unauthenticated POSTs to admin-ajax.php with action parameters matching Zephyr plugin hooks; inspect database wp_posts or wp_options tables for recently inserted script tags or unexpected HTML in project descriptions.

• action=zephyr_project_manager_* (various AJAX actions without _wpnonce)
• wp-content/plugins/zephyr-project-manager/
• script tags stored in project description fields

What your security team should do

• Immediately update the plugin to 3.2.55 across all sites
• Audit WordPress sites for presence of the vulnerable plugin version
• Enable web application firewall rules that block suspicious AJAX requests to admin-ajax.php containing script tags
• Review administrator activity logs for unexpected project or user modifications